Nov 19 (Reuters) - As a Virginia lawmaker, Ibraheem Samirah has studied internet privacy issues and debated how to regulate tech firms' collection of personal data. Still, he was stunned to learn the full details of the information Amazon.com Inc has collected on him.

The e-commerce giant had more than 1,000 contacts from his phone. It had records of exactly which part of the Quran that Samirah, who was raised as a Muslim, had listened to on Dec. 17 of last year. The company knew every search he had made on its platform, including one for books on "progressive community organizing" and other sensitive health-related inquiries he thought were private.

"Are they selling products, or are they spying on everyday people?" asked Samirah, a Democratic member of the Virginia House of Delegates.
Samirah was among the few Virginia legislators who opposed an industry-friendly, Amazon-drafted state privacy bill that passed earlier this year. At Reuters' request, Samirah asked Amazon to disclose the data it collected on him as a consumer.

The company gathers a vast array of information on its U.S. customers, and it started making that data available to all upon request early last year, after trying and failing to defeat a 2018 California measure requiring such disclosures. (U.S. Amazon customers can obtain their data by filling out a form on Amazon.com. https://www.amazon.com/gp/help/customer/display.html?nodeId=GXPU3YPMBZQRWZK2)

Seven Reuters reporters also obtained their Amazon files. The data reveals the company's ability to amass strikingly intimate portraits of individual consumers.

Amazon collects data on consumers through its Alexa voice assistant, its e-commerce marketplace, Kindle e-readers, Audible audiobooks, its video and music platforms, home-security cameras and fitness trackers. Alexa-enabled devices make recordings inside people's homes, and Ring security cameras capture every visitor.

Such information can reveal a person's height, weight and health; their ethnicity (via clues contained in voice data) and political leanings; their reading and buying habits; their whereabouts on any given day, and sometimes whom they have met.

One reporter's dossier revealed that Amazon had collected more than 90,000 Alexa recordings of family members between December 2017 and June 2021 – averaging about 70 daily. The recordings included details such as the names of the reporter's young children and their favorite songs.

Amazon captured the children asking how they could convince their parents to let them "play," and getting detailed instructions from Alexa on how to convince their parents to buy them video games. Be fully prepared, Alexa advised the kids, to refute common parent arguments such as "too violent," "too expensive" and "you're not doing well enough in school." The information came from a third-party program used by Alexa called "wikiHow" that provides how-to advice from more than 180,000 articles, according to Amazon's website.

Amazon said it does not own wikiHow, but that Alexa sometimes responds to requests with information from websites.

Some recordings involved conversations between family members using Alexa devices to communicate across different parts of the house. Several recordings captured children apologizing to their parents after being disciplined. Others picked up the children, ages 7, 9 and 12, asking Alexa questions about terms like "pansexual."

In one recording, a child asks: "Alexa, what is a vagina?" In another: "Alexa, what does bondage mean?"

The reporter did not realize Amazon was storing the recordings before the company disclosed the data it tracked on the family.

Amazon says its Alexa products are designed to record as little as possible, starting with the trigger word, "Alexa," and stopping when the user's command ends. The recordings of the reporter's family, however, sometimes captured longer conversations.

In a statement, Amazon said it has scientists and engineers working to improve the technology and avoid false triggers that prompt recording. The company said it alerts customers that recordings are stored when they set up Alexa accounts.

Amazon said it collects personal data to improve products and services and customize them to individuals. Asked about the records of Samirah listening to the Quran on Amazon's audiobooks service, Amazon said such data allows customers to pick up where they left off from a prior session.

The only way for customers to delete much of this personal data is to close their account, Amazon said. The company said it retains some information, such as purchase history, after account closure to comply with legal obligations.

Amazon said it allows customers to adjust their settings on voice assistants and other services to limit the amount of data collected. Alexa users, for instance, can stop Amazon from saving their recordings or have them automatically deleted periodically. And they can disconnect their contacts or calendars from their smart-speaker devices if they don't want to use Alexa's calling or scheduling functions.

A customer can opt out of having their Alexa recordings examined, but they must navigate a series of menus and two warnings that say: "If you turn this off, voice recognition and new features may not work well for you." Asked about the warnings, Amazon said consumers who limit data collection may not be able to personalize some features, such as music playback.

Samirah, 30, got an Amazon Alexa-enabled smart speaker during last year's holiday season. He said he only used it for three days before returning it after realizing it was collecting recordings. "It really sketched me out," he said.

The device had already gathered all of his phone contacts, part of a feature that allows users to make calls through the device. Amazon said Alexa users must give permission for the company to access phone contacts. Customers must disable access to phone contacts, not just delete the Alexa app, in order to delete the records from their Amazon account.

Samirah said he was also unnerved that Amazon had detailed records of his audiobook and Kindle reading sessions. Finding information about his listening to the Quran disclosed in his Amazon file, he said, made Samirah think about the history of U.S. police and intelligence agencies surveilling Muslims for suspected terrorist links after the attacks of Sept. 11, 2001.

"Why do they need to know that?" he asked. Samirah's term ends in January, after he lost a bid for re-election earlier this year.

At times, law-enforcement agencies seek data on customers from technology companies. Amazon discloses that it complies with search warrants and other lawful court orders seeking data the company keeps on an account, while objecting to "overbroad or otherwise inappropriate requests."

Amazon data for the three years ending in June 2020, the latest available, show the company complied at least partially with 75% of subpoenas, search warrants and other court orders seeking data on U.S. customers. The company fully complied with 38% of those requests.

Amazon stopped disclosing how often it complies with such requests last year. Asked why, Amazon said it expanded the scope of the U.S. report to make it global, and "streamlined" the information from each country on law enforcement inquiries. The company said it is obligated to comply with "valid and binding orders," but that its goal is to release "the minimum" required by law.

Amazon's 3,500-word privacy policy, which links to more than 20 other pages related to privacy and user settings, gives the company wide latitude to collect data. Amazon said the policy describes its collection, use and sharing of data "in a way that is easy for consumers to understand."

That information can get quite personal. Amazon's Kindle e-readers, for instance, precisely track a user's reading habits, another reporter's Amazon data file showed. The disclosure included records of more than 3,700 reading sessions since 2017, including timestamped logs – to the millisecond – of books read. Amazon also tracks words highlighted or looked up, pages turned and promotions seen.

It showed, for instance, that a family member read "The Mitchell Sisters: A Complete Romance Series" on Aug. 8, 2020, from 4:52 p.m. until 7:36 p.m., flipping 428 pages.

Florian Schaub, a privacy researcher at the University of Michigan, said businesses are not always transparent about what they're doing with users' data. "We have to rely on Amazon doing the right thing," he said, "rather than being confident the data can't be misused."

(Reporting by Chris Kirkham and Jeffrey Dastin; editing by Peter Hirschberg and Brian Thevenot)

Source